Will the Sasser worm become the next Blaster?

[kers0r]

The LSASS Sasser worm is spreading through the documented MS04-011 (LSASS) vulnerability. Presently this worm has not gotten to plague proportions but statistically it may well.

Apart from the Sasser worm problem, there also remains the problem of human hackers exploiting this hole. Warez ftp hackers have already started using an exploit targeting unpatched systems creating "pubstro" warez dumps. The DCOM vulnerability saw numero
us script kiddie tools created that allowed trojan hackers to upload and run trojan servers, will we see another wave of tools being created?

-----------------------------------
Jonathan Read (aka kers0r)
http://www.anti-trojan.org

[Gadi Evron]

kers0r wrote:
>
> The LSASS Sasser worm is spreading through the documented MS04-011 (LSASS) vulnerability. Presently this worm has not gotten to plague proportions but statistically it may well.
>
> Apart from the Sasser worm problem, there also remains the problem of human hackers exploiting this hole. Warez ftp hackers have already started using an exploit targeting unpatched systems creating "pubstro" warez dumps. The DCOM vulnerability saw nume
rous script kiddie tools created that allowed trojan hackers to upload and run trojan servers, will we see another wave of tools being created?

As to the FTP component of Sasser and how to scan for it, see below.

We encounter new worms and new exploits on practically a daily bases.
Kiddies port-scan for open Trojan ports and vulnerable systems so much
that you can't even keep track and your logs grow out of proportion.

It was clear that a worm would use this exploit soon, and I am one of
those who support the "historical view" of how long it takes for a worm
to be created after a serious vulnerability is found and a POC becomes
public. However, I do not really find the need for speculation.

The vulnerability has been out for a while now, and it was patched.
Firewall companies with application filtering capabilities, Application
Firewalls, etc. have all added filtering for it, as have all the network
vulnerability scanners (detection rules).

Would that stop any network worm from becoming "huge"? No. Would that
worm become huge? Maybe. Would it help slow down a worm? Definitely.
This is not a 0-day. It won't be another Code Red. Would it be big? It
already is, but how many big worms do we see in a month?

What I suggest is doing what one can. Patching, updating AV solutions,
running snort rules (Martin Overton's snort rules for Sasser.A and
Sasser.B can be found at: http://arachnid.homeip.net/cgi-bin/blah/Blah.pl).

Being prepared is always a good idea, but the media frenzy will be huge
as it is, why add to it?

About your concerns with warez FTP bases, etc., Well... the
vulnerability, POCs and tools have been out for a while. Kiddies always
find new homes and break into systems, I don't really see how one
vulnerability would make a difference, and it haven't thus far.

As to the worm, it IS very interesting, and might be a serious threat
for a while. How big exactly we will only know Monday morning, EU time, imo.

You can find a really good analysis of the worm by Joe Stewart at LURHQ:
http://www.lurhq.com/sasser.html

On a half related note on scanning for Sasser, as kiddies will soon
start scanning anyway, might as well help admins out -
I was told on the TH-Research (the Trojan Horses Research mailing list -
http://ecompute.org/th-list) online war room that if you simply port
scan for Sasser you get many false positives, as that port (5554) is
also used by Oracle. If you get "200 OK" as a reply though in the first
packet, it's Sasser.

Gadi Evron.

--
Email: ge@linuxbox.org. Backup: ge@warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104 C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email:
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA 569A A87E 8DB7 06C7 D450

[Damian Menscher]

Gadi Evron <ge linuxbox org> wrote:
> if you simply port scan for Sasser you get many false positives, as
> that port (5554) is also used by Oracle. If you get "200 OK" as a
> reply though in the first packet, it's Sasser.

Another false positive is IRIX boxes which listen to port 5554/tcp for
esp-httpd (their "Embedded Support Partner"). From the default
/etc/inetd.conf:
sgi-esphttp stream tcp wait root /usr/etc/esphttpd esphttpd -u300

To cut down on false positives, I tried scanning for BOTH 5554/tcp AND
9996/tcp. Unfortunately we found that very few (about 2%) of the
infected machines had both ports open. Another 1% had only port
9996/tcp open. The remaining 97% had only 5554 open.

Damian Menscher
--
-=#| Physics Grad Student & SysAdmin @ U Illinois Urbana-Champaign |#=-
-=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=-
-=#| <menscher@uiuc.edu> www.uiuc.edu/~menscher/ Fax:(217)333-9819 |#=-
-=#| The above opinions are not necessarily those of my employers: |#=-
-=#| UIUC CITES Security Group || Beckman Imaging Technology Group |#=-

[Pullum, Stephen]

From lurhq.com...

Update: May 3, 2004
The authors of the Netsky virus have claimed authorship of Sasser in
comments included in the code of Netsky.AC. They provide a snippet of source
code as proof. LURHQ has also independently compared the binary code of both
Sasser and Netsky and found other evidence supporting a common source code
base in the two programs. Therefore the claim of "Team Skynet" appears to be
credible.

Like Netsky, new variants of Sasser are being released quickly. As of this
writing, four variants have been uncovered:

Variant Size MD5 Executable Compile Date
A 15,872 a73c16ccd0b9c4f20bc7842edd90fc20 avserve.exe Fri Apr 30 19:23:16
2004
B 15,872 1a2c0e6130850f8fd9b9b5309413cd00 avserve2.exe Sat May 1 07:39:48
2004
C 15,872 831f4ee0a7d2d1113c80033f8d6ac372 avserve2.exe Sat May 1 14:07:32
2004
D 16,384 03f912899b3d90f9915d72fc9abb91be skynetave.exe Sun May 2 10:53:43
2004

Differences between variant A and B were changes to the code to implement a
psuedo-forking mechanism when exploiting hosts. Variant C changed the number
of scanning threads to 1024 instead of 128. Variant D changed the number of
scanning threads back to 128 and implemented a ICMPSendEcho API call prior
to connecting to a host via TCP in order to speed up scanning (much in the
same way the Welchia worm does). Due to a bug, the D variant does not appear
to run on Windows 2000, so an E variant may be forthcoming shortly.


-----Original Message-----
From: kers0r [mailto:root@asylum-nz.com]
Sent: Saturday, May 01, 2004 8:30 PM
To: bugtraq@securityfocus.com
Subject: Will the Sasser worm become the next Blaster?



The LSASS Sasser worm is spreading through the documented MS04-011 (LSASS)
vulnerability. Presently this worm has not gotten to plague proportions but
statistically it may well.



Apart from the Sasser worm problem, there also remains the problem of human
hackers exploiting this hole. Warez ftp hackers have already started using
an exploit targeting unpatched systems creating "pubstro" warez dumps. The
DCOM vulnerability saw numerous script kiddie tools created that allowed
trojan hackers to upload and run trojan servers, will we see another wave of
tools being created?



-----------------------------------

Jonathan Read (aka kers0r)

http://www.anti-trojan.org